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Abstract 

This paper addresses different methods for determining the amount of extra propellant (flight performance 
reserve or FPR) that is necessary to reach orbit with a high probability of success. One approach involves assuming 
that the various influential parameters are independent and that the result behaves as a Gaussian. Alternatively, 
probabilistic models may be used to determine the vehicle and environmental models that will be available 
(estimated) for a launch day go/no go decision. High-fidelity closed-loop Monte Carlo simulation determines the 
amount of propellant used with each random combination of parameters that are still unknown at the time of launch. 
Using the results of the Monte Carlo simulation, several methods were used to calculate the FPR. The final chosen 
solution involves determining distributions for the pertinent outputs and running a separate Monte Carlo simulation 
to obtain a best estimate of the required FPR. This result differs from the result obtained using the other methods 
sufficiently that the higher fidelity is warranted. 

Introduction 

This paper focuses on determining how much extra propellant (called flight performance reserve, or FPR) a 
launch vehicle needs to have available for ensuring it reaches the targeted orbit, in order to compensate for all the 
uncertainties in vehicle and environmental parameters that impact performance. One of the experiences during Ares 
I launch vehicle development is that the FPR needed an increase during each design cycle due to increasing fidelity 
of the system models. Some of the reasons for the increase included simply modeling all the uncertainties for the 
first time, increasing the fidelity of modeling the propulsion system, modeling low propellant cutoff sensors and 
their uncertainties, and increasing the uncertainty of propellant tank loading. Therefore, FPR is an area that can eat 
into margins if there is insufficient conservatism at the start of a program. 

The Space Shuttle program uses a procedure that evaluates the impact of each important parameter on the 
ascent propellant remaining and then assumes the various parameter impacts are independent and that the result 
behaves as a Gaussian (Ref. 1). Essentially a root sum square (RSS) of the various propellant remaining standard 
deviations for each input variation is calculated. This approach is tried in this paper for the Ares I vehicle models. 

Because a launch vehicle ascent trajectory is highly nonlinear and is influenced by many parameters, 
running Monte Carlo simulations with all uncertainties included is another potential way to evaluate how much extra 
fuel and oxidizer is needed to enable the vehicle to reach orbit for the specified percentage of cases. The simulations 
include high-fidelity models of how the vehicle behaves, including such effects as navigation error, vehicle 
vibrations, fuel slosh, effect of data delays, dynamics resulting from the engine nozzle movement, and many others. 
These high-fidelity models would also be used with the RSS approach described above. 

The FPR should only cover for the uncertainties that exist on flight day, because any uncertainties that exist 
when the vehicle is being designed, but are known on flight day can be taken into account in making the go/no go 
launch decision. Some vehicle parameters that are not well known during design will be better known about a 
particular launch vehicle prior to launch, so these parameters would be used in designing the trajectory and would 
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not be considered launch day uncertainties. This may include, for example, vehicle component weights and certain 
engine parameters. Developing probabilistic vehicle models for these parameters that are known prior to launch is 
discussed in Ref. 2. Also the launch day wind and temperature are measured, so all these parameters are known 
when the decision is made to launch. Assuming the propellant tanks are to be filled to a standard “full” amount (also 
with uncertainty), FPR covers for the flight day uncertainties, plus any other uncertainties that cannot otherwise be 
accommodated. 

There are vehicle models where plenty of propellant is available, and a precise determination of the FPR 
needs is not so critical (e.g. a model with lighter masses and higher engine thrust). But during design, the 
performance-driving cases must be examined closely, and typically during a flight program there are performance- 
driving launches that make every kilogram precious. This was certainly the case in both the Apollo and Space 
Shuttle programs, when the lunar rover was added to the payload and when flights to assemble the International 
Space Station were planned. On the Shuttle, performance shortfalls resulting from lessons learned during initial 
flights also drove a need for more performance. Other launch vehicles generally have some payloads that are 
designed after the rocket is already flying and use all the performance available. 

Besides the RSS approach, other approaches tried in this paper include fitting a two-dimensional (fuel and 
oxidizer) Gaussian distribution to the propellant remaining results, using binomial acceptance criteria to obtain the 
required propellant levels, and the method that was finally adopted that involves determining distributions of the 
parameters of interest and running a larger Monte Carlo simulation where samples are taken of these distributions. 

If it were possible to examine an infinite number of Monte Carlo samples, the statistics in the tail of the 
probability distribution of propellant remaining would be sufficiently accurate. But computer limitations, and the 
fact that a number of simulations are needed for varying purposes, means that the tail data have a small number of 
points. Besides the need to look in the distribution tail for the data of interest (e.g., between the last two data points 
in a Monte Carlo simulation of 2000 samples), low propellant cutoff sensors become important in the performance- 
driving cases. If these sensors command the engine shutdown prior to when the normal shutdown would occur 
(when the guidance system determines the engine should shut down to achieve the nominal orbit injection 
conditions), any uncertainties associated with these shutdowns will affect the result in only a small number of cases. 
So the results cannot be considered to be accurate with any reasonable confidence. 

The Ares I rocket consists of a First Stage that uses a five-segment solid rocket motor based on Space 
Shuttle technology, and an Upper Stage that uses a J-2X engine based on updates from Apollo technology. In order 
to remove any concerns about publishing sensitive data, all liquid oxygen (L02) remaining values have been 
multiplied by a factor, and all liquid hydrogen (LH2) remaining values have been multiplied by a different factor. 
Although this approach will change the results, it will not affect the relative answers. For example, if P is the 
nominal propellant, and P 2 = m*P is the adjusted propellant, where m is the multiplier, then in the original results P 
- FPR is the propellant without FPR. m*(P - FPR) = m*P - m*FPR = P 2 - m*FPR and so the propellant without 
FPR is adjusted by the same factor, with FPR 2 = m*FPR. In computing the RSS result, if each variation in 
propellant is multiplied by m, then m factors out from the square root and the result is that the total RSS estimate is 
multiplied by m. One additional change made is that some of the uncertainties used are not their true values, so that 
the sensitivities are not the true ones. 

RSS Approach 

The FPR should cover for flight day uncertainties (all parameter variations that are uncertain at the time of 
the launch decision) and for any other uncertainties that must be covered by FPR. An example of the latter is the 
full engine mixture ratio variation (variation of the ratio of oxidizer used to fuel used) for Ares I. Because the 
propellant tanks would be filled on launch day regardless of any mixture ratio variation that might be known prior to 
launch (from testing the engine, for example), FPR sizing during the vehicle design process has to cover for whether 
that mixture ratio value is high or low, because it could be either for a particular vehicle that is assembled. On 
launch day, the go/no go decision can be made with this known variation in mind, so the FPR set aside when making 
that decision could be reduced to reflect the reduction in uncertainty. 

Table 1 shows the impact to the liquid oxygen (L02) remaining and to the liquid hydrogen (LH2) 
remaining from the set of known influential input variations. The results in the table were derived by running the 
ascent simulation while varying only the individual parameter being investigated. Assuming that the output variation 
derived from a 99.865% input variation is a 99.865% value and that all the outputs are independent, one may 
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compute the RSS (square root of the sum of the squares of all the impacts) to obtain 653.3 kg for the L02 needed 
and 540.1 kg for the LH2 needed for FPR. 

With this result obtained, the next step is to explore the various approaches that use Monte Carlo 
simulation. 

Table 1. Impact on propellant remaining from known influential input parameters (input variation 
corresponding to 99.865% value). 


Input Parameter 

Impact to L02 remaining (kg) 

Impact to LH2 remaining (kg) 

FS burn rate - 

-329 

-90 

FS Isp - 

-366 

-100 

PMBT - 

-40 

-11 

Axial force coefficient + 

-20 

-5 

J-2X Isp - 

-178 

-49 

J-2X thrust - 

-77 

-21 

Mixture ratio + 

-275 

0 

Mixture ratio - 

0 

-422 

LOX loading + for LH2, - for L02 

-193 

-202 

LH2 loading + for L02, - for LH2 

-138 

-225 

US dry masses 

-8 

-2 

FS dry masses 

-64 

-17 

FS propellant load 

-72 

-20 

Delta staging time 

-60 

-16 

L02 inlet conditions 

-2 

-3 

LH2 inlet conditions 

-8 

-10 

inlet pressures 

-5 

-9 


Uncertainties and Vehicle Models 

When designing launch vehicles, there are several types of uncertainties, divided up by when they become 
known, i.e. adequate information is available. The three categories are distinguished by the following information: 

• Uncertainties that are unknown while the design proceeds, but are known for a particular assembled 
vehicle. For example, engine thrust and efficiency (specific impulse, a measure of the thrust achieved 
for each kilogram of propellant) will be better known after the design is complete and an engine is in 
hand, and the engine may be fired on a test stand and its parameters measured. Components will be 
weighed prior to flight day. Aerodynamic coefficients will be better known from all the wind tunnel 
tests and other analysis. 

• Environmental parameters that are known prior to launch, particularly the measured wind on flight day 
and estimated temperatures of solid propellants. 

• Parameters that are still uncertain when the vehicle launches. All vehicle and environmental models 
have uncertainties that remain when the vehicle launches. 

Results would not be acceptable if all these uncertainties were simply randomly varied in a Monte Carlo 
simulation. Figure 1 shows how much the results change if two independent parameters with equal Normal 
distributions (standard deviation of 1.0) are evaluated separately versus if both are put in the same Monte Carlo 
simulation. When evaluated separately, the first distribution represents parameters known prior to flight day and the 
second represents parameters unknown on flight day. If any vehicle model must be able to successfully fly, then 
flight success must be achieved with a vehicle in the tail of the first distribution. So, for example, a 3 -sigma value of 
the first distribution provides the nominal for the flight. The flight day uncertainties are distributed about this new 
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mean, with the result that a 3 -sigma high value of the parameters has a value of about 6 as compared to less than 5 if 
the parameters are not addressed separately. 

With this in mind, models are developed for a launch vehicle, using a probabilistic combination of the 
parameters known prior to flight day. Then, using simulation, a particularly bad launch day (headwinds and low 
temperatures) is chosen for a February launch (lowest performance month), since a successful design will provide 
for successful launch any time of year and in most temperature and wind situations. Development of these vehicle 
models and this approach is described in more detail in Ref. 2. Because the engine mixture ratio (ratio of the flow 
rate of oxidizer to the flow rate of fuel) is one of the parameters that will be better known for a particular engine that 
is tested and put on the vehicle, vehicle models are developed separately for one that yields a particularly low level 
of oxidizer (liquid oxygen in this paper) remaining upon arrival in orbit and for one that yields a low level of fuel 
remaining (liquid hydrogen). Once all these models are defined, the question is then how much liquid oxygen 
(L02) must be set aside to cover for the low oxidizer case and how much liquid hydrogen (LH2) must be set aside to 
cover for the low fuel case, to ensure they reach orbit in the required percentage of simulations. 

There is a subtle difference between the engine mixture ratio uncertainty and other uncertainties that are partially 
estimated prior to launch day. For parameters such as engine thrust and specific impulse, having a more precise 
number available (there is still some uncertainty at the time of launch) allows for its use in trajectory design and in 
determining the propellant used for nominal flight at nominal mixture ratio, so the effects of improved information 
on these parameters prior to flight day would not be part of the FPR. As mentioned before, since the tanks will be 
filled to the nominal fill levels (with uncertainty), mixture ratio variations are included in FPR even though they are 
partially known prior to launch. The trajectory design and nominal performance are unaffected by mixture ratio 
variation, unlike the other parameters. 



Figure 1. Effect of separating vehicle models and flight day uncertainties as compared to not separating 
them. 
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Number of Monte Carlo Samples 

A typical requirement might state that orbit must be successfully achieved in 99.86% of Monte Carlo samples with 
10% “consumer risk”. 99.86% is approximately a one-tailed 3-sigma level for Normal distributions. The consumer 
risk statement basically means that, if 10,000 Monte Carlo runs (of, say, 2000 random samples each) were to be 
made, 1 0% of them would show the requirement not being met and 90% would show the requirement is met. That 
is, consumer risk is the risk that the design is accepted as meeting the requirement when in fact it does not meet the 
requirement. 

If running out of propellant (oxygen or hydrogen) before arriving successfully in orbit is considered to be a 
failure, and arriving in orbit is a success, then the binomial probability of k failures in an TV-sample Monte Carlo run 
may be written as 


(n\ 


^Bw( fr |p.-V)= , /(l-p) 


K k J 


\N-k 


(i) 


where p is the actual probability of failure for each Monte Carlo sample. Summing this probability from 0 to k 
(where k = 5) provides the decreasing probability curve in Figure 2 (called the “operating characteristic”). So for a 
very low actual failure probability, the chance is near 100% that 5 or fewer failures will occur in 2000 samples. At 
the intuitive failure probability of 0.25% (5/2000), the chance is >60% that the real failure probability is larger given 
that 5 failures are observed. In order to achieve a chance of less than 10% of the actual failure probability being 
greater than the estimated value, one must allow for a failure probability of about 0.47%. These concepts are 
developed in more detail in Ref. 2. 



Actual p 

Figure 2. Probability of a sum of failures in 2000 samples as a function of the actual failure probability 

One can interpolate between data points in the tail of the distribution (Ref. 2) to accurately meet the 
specified success level (for the particular Monte Carlo result being examined). To meet the 99.86% with 10% 
consumer risk (90% confidence) requirement with 2000 Monte Carlo samples, point 1999.69 out of 2000 provides 
the appropriate setting for parameters of interest. This point is very close to the last point, illustrating how much 
conservatism must be added to account for the consumer risk part of the requirement: 0.9986 corresponds to 2.8 
failures ( 0.9986 = 1 - 2.8 / 2000 ). 
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Definition of Success 


Success in reaching orbit means that the desired semi-major axis has been achieved to within a specified accuracy, 
taken here to be +/- 15 km. The launch vehicle’s guidance system commands engine shutdown when the energy has 
reached a sufficient level so that the expected additional energy supplied by the engine during the shutdown process 
will provide just enough to yield an orbit that is exactly at the desired semi-major axis. Uncertainties in the amount 
of impulse achieved during engine shutdown, navigation errors, and other variations, lead to an actual semi-major 
axis that is distributed about the nominal value and is within 15 km of the desired value. If either L02 or LH2 is 
running low, there are low propellant cutoff sensors that shut the engine down in order to ensure the engine does not 
run dry (which can be catastrophic). In these situations, the engine is shutting down before the guidance believes the 
appropriate point has been reached. However, if the semi-major axis is within 15 km of the target, these cases 
would be considered to be successes. 

FPR Calculation: Some Candidate Approaches and Comparisons 

Generating 2000 Monte Carlo samples for the low oxidizer and low fuel scenarios resulted in the situation shown in 
Figures 3 and 4 for a sample analysis. These results are for simulations that began with what was thought to be 
sufficient FPR (extra L02 and LH2), based on previous analyses. Twelve of the low L02 cases were shut down by 
the low propellant sensor and three of the low LH2 cases were shut down early. Some propellant remains in each 
case since the low propellant sensors are placed in order to ensure that the tanks don’t run completely dry. 

All of the sample simulations in the Monte Carlo runs satisfied the semi-major axis limits if they were not 
shut down by the low fuel sensors. Most of the ones shut down by the low fuel sensors also met the insertion 
accuracy specification. In fact, only four of the low L02 cases were not within 1 5 km of the target, and only one of 
the low LH2 cases was not within 15 km of the target (Figure 4). In the case of LH2, the one case that does not 
meet the required insertion is close enough that the 1999.69 value (interpolating between point 1999 and this last 
point) barely meets the 15 km value. It turns out that if about 91 kg of L02 is added (taken from vehicle payload), 
then the L02 results in Figure 4 will improve to the point that the requirement is met for both L02 and LH2. 

Several methods may now be compared for determining the required FPR. Besides the previously 
described RSS approach and the approach of taking point 1999.69 from the just-described Monte Carlo simulation, 
two more methods were tried. The first is to fit a two-dimensional Gaussian distribution to the propellant remaining 
results and to compute a FPR that will satisfy the 99.86% with 10% CR requirement assuming the distribution is 
correct. The data appear to be fairly close to Gaussian (see for example the left side of Fig. 5). This method 
minimizes the sum of the masses of the two propellants for each of the two Monte Carlo simulations; the low L02 
case and the low LH2 case. The FPR must then include the L02 value resulting from the low L02 case and the 
LH2 value resulting from the low LH2 case. This method is developed in Ref. 3. 

The second additional method works just like the first, except that prior to doing the optimization, each 
propellant remaining number is adjusted to obtain the value that would just meet the minimum semi-major axis 
requirement. If there are cases that fall below the semi-major axis requirement, they are adjusted upwards (the 
method for doing this is described later in the paper) and more propellant is assumed to be used to get there. The 
reverse is done for cases that exceed the requirement. The effect of this is to define propellant numbers that will just 
meet the accuracy requirement, so that the lowest propellant remaining case that is needed just meets the insertion 
accuracy. The rest of the successful cases will have plenty of propellant. This will reduce the FPR as compared to 
the method discussed in the last paragraph, since achieving the minimum semi-major axis target uses less fuel in 
general than achieving a nominal cutoff before running out of propellant would use. 

These various methods result in Table 2, which also gives the number of failures that would likely result if 
these changes were in fact made. This estimate of the number of failures comes from looking at the additional 
number of cases that would fall below the line with this change in FPR, using Fig. 3. A higher- fidelity answer for 
the number of failures could be obtained by re-running the Monte Carlo simulation with these adjusted FPR values. 

It is possible that this RSS approach did not capture all the appropriate varying parameters, but the result is clearly 
too small. 

It should be noted that the number of failures in Table 2 correspond to the vehicle model that is driving low 
propellant, launched on a particularly challenging day. Any other vehicle model would yield better results (fewer or 
no failures). Of course, if a less challenging vehicle model were chosen to drive the requirements (assuming that the 
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engine would be swapped out if it produced such a challenging case as this one), this same analysis could be 
performed with the less challenging model. 
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Figure 3. Usable propellant remaining for (a) low L02 remaining case and (b) low LH2 remaining case. 


Issues with the Approaches 

All the results in Table 2 are only accurate if all the input models and uncertainty values are correct, but 
examination of those is beyond the scope of this paper. The last result in Table 2 is the only one that can be shown 
(in the particular Monte Carlo simulation that was run) to satisfy the requirement. In the other cases, too many 
failures occur to allow that FPR to satisfy the requirement. Even though it meets the numerical requirement, there 
are several problems with the last result in Table 2. Issues that will be addressed include: 


• The low propellant cutoff sensors measure propellant level in the tanks, essentially measuring volume 
remaining. There is uncertainty in the volume remaining when the sensors sense that they have gone dry, 
uncertainty in the propellant density (and thus the mass of propellant remaining), and uncertainty in the 
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engine impulse and propellant usage during engine shutdown. With only four to twelve shutdown data 
points contributing to the analysis, this does not lead to good statistical results. 

• Obtaining the results from the last two data points in the tail of the distribution means that the points are not 
that accurate. The variations in the simulation that led to these two furthest outliers are somewhat random 
and lie at random points in the tail of the true distribution that is being sampled. (This is covered 
mathematically by conservatism in the value chosen that yields 10% consumer risk; see next bullet.) 

• The small number of failures allowed (using point 1999.69) means that there is some probabilistic 
conservatism in the result (in order to achieve 10% consumer risk). So it may be that the true distribution 
requires less propellant. 
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Figure 4. Semi-major axis error for (a) low L02 remaining case and (b) low LH2 remaining case. 
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Table 2. FPR results using various approaches. 


Approach 

L02 FPR 
(kg) 

LH2 FPR 
(kg) 

Approx, 
number of 
L02 failed 
cases 

Approx, 
number of 
LH2 failed 
cases 

Nominal FPR used for Fig 3 

912.2 

663.5 

4 

1* 

RSS Approach 

653.3 

540.1 

48 

7 

Fit distribution to MC results for propellant 
remaining 

897.9 

681.2 

5 

0 

Adjust propellant remaining to hit minimum 
semi-major axis, fit distribution to MC results 

841.7 

665.9 

11 

0 

Assure that 1999.69 value reaches semi-major 
axis 

1003.2 

663.5 

1** 

1* 


*1999.69 value is very close to meeting the requirement. 

**1999.69 value defines the boundary; point 2000 just fails to meet the requirement. 


Is there really enough LH2? And is 91 kg the right amount of L02 that needs to be added? Maybe the right 
value is 50, or 150. If 50 kg can be saved, that is 50 kg that can be used for more payload. Ideally a simulation 
would be run that contains enough samples so that good statistics would be obtained for the low propellant cutoff 
sensors (1000 or more samples where the low fuel cutoff sensors commanded shutdown), and so that the extra 
conservatism would be removed. With a large number of Monte Carlo samples, the number of allowed failures with 
10% consumer risk more closely approximates the overall allowed number of failures. For example, if 400,000 
samples are run, 529 failures are allowed. This represents a 99.868% success rate, much lower than the 99.98% rate 
represented by the 1999.69 point. Also, with the low propellant cutoff sensor results, 12 and 4 cases out of 2000 
corresponds roughly to 2400 and 800 cases for 400,000 samples, respectively. Unfortunately, much larger samples 
than the 2000 already run are not feasible within the computer resources available. Some slightly larger runs are 
possible in special cases. 

Figure 5 compares the experimental distribution with no low propellant cutoff sensor to a Gaussian distribution 
with the same mean and standard deviation. Although the fit appears to be quite good in the left graph, the fit at the 
low end of the tail in the Gaussian approximation shows better propellant remaining than what the experimental data 
show. So a Gaussian approximation is inadequate, even without the issue of the low propellant cutoff sensors. 

Refined Approach 

In order to generate proper statistical results, the following approach was used (once each for both the L02 
and LH2 cases): 

• Perform a Monte Carlo simulation (2000 samples) in which performance was artificially reduced so that all 
cases were shut down by the low propellant cutoff sensors. Using this, generate a distribution for the 
propellant remaining at the cutoff command when these sensors command the shutdown. 

• Perform a 10,000-sample Monte Carlo simulation where the low fuel sensors are disabled (assuming that 
10,000 samples represents a reasonable maximum with computer limitations taken into account). This will 
generate a distribution for the fuel remaining when guidance commands the shutdown that is better than the 
previous distribution (of 2000 samples). More samples would be desirable, but computer limitations drive 
the limit. 

• Also from the 10,000-sample run, generate distributions for the semi-major axis error at the time of 
guidance command and for the propellant used during shutdown. As seen in Figure 6, the change in semi- 
major axis during the engine shutdown is nearly completely correlated with the propellant used during 
shutdown, so that if one knows the propellant used, then the semi-major axis gain during shutdown is 
determined. 

• With the above distributions available, run a 400,000-sample Monte Carlo simulation that picks random 
values from the distributions (and does not run the ascent simulation). This 400,000-sample simulation 
runs very quickly on a computer. This simulation will yield a sizable distribution tail and will allow for 
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many failures (529 for the 99.86% with 10% consumer risk success level), so that good statistics of the 
required propellant should result. 




Figure 5. L02 remaining after shutdown if there is no low propellant cutoff sensor (10,000 samples). The 
graph on the left is probability density, comparing the experimental distribution to a Gaussian distribution 
with the same mean (689.2812) and standard deviation (219.0123). The graph on the right shows the 
cumulative distribution, focusing on the lower tail. Individual results are visible in the experimental 
distribution. 
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Figure 6. Demonstration that the semi-major axis change during shutdown is highly correlated to 
propellant used during shutdown, for (a) low L02 remaining case and (b) low LH2 remaining case. 
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In each of the 400,000 samples: 

• Randomly choose a propellant remaining from the guidance-commanded shutdown distribution and from 
the low propellant sensor shutdown distribution. If the guidance-commanded value is higher, then the 
shutdown is due to guidance and the orbit insertion is successful. 

• For cases where the low propellant sensor value is higher, the engine shut down early. The first step is to 
determine what the semi-major axis error would have been if the vehicle had not shutdown early. Choose a 
random semi-major axis error at guidance shutdown command value from that distribution, and a random 
propellant used during shutdown value from its distribution, yielding the semi-major axis the vehicle would 
achieve during shutdown. From these, calculate the semi-major axis error that would have resulted if 
guidance commanded the shutdown in this case. 

• The next step adjusts the final guidance-commanded semi-major axis error in order to yield the semi-major 
axis error due to the low propellant sensor shutdown. This is based on the remaining propellant level 
differences from when the low propellant sensor commanded the shutdown as compared to when the 
guidance wanted to command the shutdown. This difference in thrusting due to differing propellant levels 
at the commanded shutdown is done at full thrust, so equations will be used rather than using the data for 
what happens during shutdown in Fig. 6. Start by using the rocket equation (equation 2) to calculate the 
change in velocity available from the delta propellant. Reduce this change in velocity to account for cosine 
losses on the nominal trajectory, using the nominal angle between the vehicle thrust and the velocity vector 
at the time of engine cutoff (equation 3). Then use the energy equation (equation 4) to calculate the change 
in semi-major axis. 

The rocket equation is 


AV = g * Isp * In 


( \ 

m n 


\ m f) 


( 2 ) 


where AV is the change in speed, g is the gravity acceleration at sea level, Isp is the engine specific impulse 
(thrust/burn rate/g), and m 0 and m f are the initial and final masses (final is initial minus propellant used). For 
propellant cosine losses, use the angle, a, between the vehicle thrust direction and the velocity vector on a nominal 
flight at the time of engine cutoff: 


AV 


AV 


reduced 


COS 


(«) 


(3) 


The energy equation can be used to determine the change in semi-major axis by the reduced change in velocity. 


v = 




(4) 


where a is the semi-major axis, p is Earth’s gravity constant, and r is the radius at the time of the burn. Equation 4 
gives the velocity at the final guidance-commanded semi-major axis. Then V - AV reduced determines the velocity at 
the end of the bum caused by the early shutdown due to the sensor. This velocity determines the semi-major axis at 
the end of the bum, using Eq. 4 arranged to solve for a. Compare this semi-major axis with the requirement to 
determine whether the insertion is successful. A flow chart of the process is shown in Figure 7. 
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Figure 7. Flowchart of the Monte Carlo process using the various distributions. LPS stands for low 
propellant sensor. 


Required Distributions 

Figure 8 shows the cumulative distribution for usable propellant remaining when the low propellant sensors 
command shutdown. Figure 9 shows the cumulative distributions for the semi-major axis error at the time of 
guidance command, when the guidance commands the shut down. As expected, it is about the same for both low 
L02 and low LH2 runs, because guidance commands the shutdown based on when orbit is about to be achieved, not 
based on propellant remaining. Figure 10 shows cumulative distributions for the propellant used during shutdown. 
The propellant used during shutdown is very close to a uniform distribution. Figure 1 1 shows the cumulative 
distributions for the propellant remaining when guidance commands the shutdown (low propellant sensor disabled). 
Note that the distributions for the low propellant cutoff sensors (Fig. 8) overlap with the low tails of the distributions 
in Fig. 11 (not so visible in the LH2 case, but with some overlap nevertheless). 

Notice that the low end of the tail of the distributions in Fig. 1 1 is still somewhat ragged (e.g. Fig. 12). The 
99.86% case for 10,000 samples is at about the 14 th data point, which is at about 130 kg. The experimental 
cumulative distribution appears to be fairly well-behaved in this region. However, since the number of data points is 
relatively few, three approaches will be tried for the L02 case when generating the 400,000 samples, in particular 
focusing on the fit of the low end of the guidance-commanded shutdown distribution in Fig. 12. The first approach 
has already been described, where random samples are taken from the experimental distribution. The other two will 
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use a Generalized Pareto Distribution (GPD) fit to the extreme values of the distribution in Fig. 11. A GPD is 
defined by 



220 240 260 280 80 100 120 140 


Usable L02 (kg) Usable LH2 (kg) 

Figure 8. Cumulative distributions for propellant remaining when the low fuel sensors command engine 
shutdown. 



Semi-major axis error (km), L02 case Semi-major axis error (km), LH2 case 

Figure 9. Cumulative distributions for semi-major axis error at the time of guidance shutdown command 

where F(x) is the cumulative distribution for the random variable x, |li is the “threshold”, £, is the “shape parameter”, 
and a is the “scale parameter”. The threshold is a value chosen in the tail, where only values beyond this are 
considered. The free statistics package “R” was used to generate the GPDs (Ref. 4). A GPD fit with a threshold of 

13 


American Institute of Aeronautics and Astronautics 







225 kg (usable L02 remaining at the time of guidance command is 225 kg or less) is shown in Figure 13. 43 data 
points out of the 10,000 are below 225 kg. A GPD fit for a threshold of 450 kg (402 data points) is shown in Figure 
14. 
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L02 used during shutdown (kg) LH2 used during shutdown (kg) 

Figure 10. Cumulative distributions for propellant used during shutdown 
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Figure 11. Cumulative distributions for propellant remaining at the time of guidance-commanded shutdown 
(low fuel sensors disabled). 
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Figure 12. Low tail of cumulative distribution for L02 from Fig. 11. 
Results 


Earlier, using 2000 samples each for L02 and LH2, the result was that 91 kg more L02 was needed and 
that the LH2 was just sufficient. Using the distributions shown in Figs. 8-11, and conducting a 400,000-sample 
Monte Carlo simulation, resulted in a need for 66 kg more L02 and an excess of 22 kg LH2, a net savings of 47 kg 
from the earlier result. Use of the GPD fit instead of the direct experimental distribution for the guidance shutdowns 
(for L02) resulted in a shortfall of 67 kg for the 225 kg threshold and 61 kg for the 450 kg threshold (compared to 
66 kg). The reduced fuel needs with the higher fidelity analysis are a combination of using more accurate 
distributions and less conservatism due to the large number of Monte Carlo samples. 



Figure 13. Generalized Pareto Distribution fit for L02 remaining at guidance command, with a 225 kg 
threshold. The negative of the propellant remaining is graphed so that the cumulative distribution has the 
normal sense of increasing with x. 
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Figure 14. Generalized Pareto Distribution fit for L02 remaining at guidance command, with a 450 kg 
threshold. The negative of the propellant remaining is graphed so that the cumulative distribution has the 
normal sense of increasing with x. Only the part of the distribution for 250 kg and below is shown, since this 
is the region of interest. 


Conclusion 

This paper addressed the need for an accurate estimate of the flight performance reserve (both fuel and 
oxidizer) needed for successful launch vehicle ascent flight. Several approaches were examined. Most methods did 
not provide sufficient precision to allow for minimization of the total needed while meeting required success 
percentages. Use of a method of combining the effects of the various input variations (assuming the effects were 
independent and that the important parameters were sufficiently captured) did not yield a FPR result that was close 
to covering for the required percentage of cases. Fitting distributions to the propellant remaining was also 
inadequate. Using binomial calculations of required success provided a better result but did not provide for sufficient 
statistical information to obtain the desired accuracy, and also included some undesired conservatism. 

The final approach involved generating distributions for 1) the propellant remaining when the guidance 
system thinks engine shutdown should occur, 2) the propellant remaining when low propellant cutoff sensors 
generate a cutoff command, 3) the propellant used during the engine shutdown, and 4) the semi-major axis error at 
the time of guidance command. These distributions were used along with the correlation between propellant used 
during shutdown and the semi-major axis gain during the shutdown, and simplified calculations of the amount of 
fuel needed to make up a semi-major axis shortfall, in a large Monte Carlo simulation of 400,000 samples with 
random choices from the various distributions. The net result of the analysis, for the case considered, was a savings 
of 47 kg in total propellant relative to the lower fidelity (2000 Monte Carlo samples with the low propellant cutoff 
sensors only active in a small number of samples) answer. The savings is in part because the required level of 
conservatism is reduced by performing a larger Monte Carlo simulation. There is also more confidence in this 
answer because the number of cases where the low fuel sensor commands the shutdowns is on the order of one 
thousand, providing much better statistical information, and also because with 400,000 samples, the random error in 
the calculation of the final answer is much less (since there are 529 cases in the outlier tail of failures rather than 
one). The results would change with any change in the vehicle models or in the uncertainties modeled. 
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The analysis in this paper focused on a vehicle model where the engine mixture ratio was known better for 
each flight than for the overall ensemble of potential vehicles. Thus vehicle models were simulated that stressed one 
propellant alternatively over the other. As a result, each propellant could be treated individually. The low L02 
remaining model drove the amount of L02 needed for FPR, and the low LH2 remaining model drove the amount of 
LH2 needed for FPR. Potential vehicle designs may not include this consideration, if nothing beyond the nominal 
mixture ratio target is known about an engine prior to launch. In this case, the driving vehicle model will stress both 
propellants at the same time. If an approach like the one developed in this paper is used, and a similar Monte Carlo 
simulation is used to generate the final result (e.g. 529 failures allowed), a simple iteration could be used to 
minimize the sum of the two propellants needed for FPR. That is, the amount of L02 needed to satisfy each failure 
case (0 to 529) and the amount of LH2 needed for each case are identified by the simulation. Requiring the sum of 
failures to be 529 allows the user to calculate the FPR needed for n L02 failures and 529 - n LH2 failures. The 
minimum FPR for which the sum of failures is 529 is the FPR that satisfies the requirement. 

A similar procedure could be used for a model where the launch day propellant loading is adjusted to 
reflect the mixture ratio estimate for the engine(s). In this case, there would again be a single model (not a separate 
one for low fuel and low oxidizer) and the FPR would only cover for that part of mixture ratio uncertainty that still 
exists on flight day. 
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